Microsoft Graph Security

Retrieve the current Microsoft Secure Score for your tenant, giving your agent an up-to-the-minute measure of your organisation's security posture.

Retrieve the historical Secure Score series for your tenant so your agent can analyse posture trends over any time window.

Modify a Secure Score control profile to update its implementation status, assigned owner, or remediation notes, keeping your score data accurate as controls are actioned.

Fetch the full list of security alerts across Microsoft Defender, Sentinel, and Entra so your agent can triage, prioritise, and route every threat without leaving its workflow.

Retrieve the full detail of a single security alert by ID, including evidence, affected entities, tactics, and recommended actions, giving your agent everything needed to drive a response.

Patch a security alert's status, assigned analyst, classification, or determination to keep alert lifecycle state accurate as your agent drives the response workflow.

Retrieve the list of security incidents in your tenant so your agent can monitor active response operations, detect SLA breaches, and drive cross-team coordination.

Retrieve the full detail of a security incident including all correlated alerts, affected assets, and response history so your agent can build a complete operational picture in one call.

Patch a security incident's status, severity, assigned team, classification, or custom tags to keep the incident lifecycle record accurate as your agent drives containment and recovery.

Retrieve the threat intelligence indicators (IPs, domains, file hashes, URLs) in your tenant so your agent can cross-reference live alerts against your curated threat-intel library.

Execute a KQL query against Microsoft Defender's Advanced Hunting dataset so your agent can proactively search for threats, anomalies, and attacker TTPs across 30 days of raw telemetry.

Retrieve all Secure Score control profiles with their current implementation status, owner, and potential score impact so your agent can identify and prioritise improvement opportunities.

TODO

TODO

TODO

Fires when Microsoft Graph Security creates a new alert across Defender, Sentinel, or Entra, immediately arming your agent with the full alert payload.

Fires when an existing alert's severity is upgraded (e.g. Low → High), signalling that new evidence has made a previously low-priority alert urgent.

Fires when Microsoft Graph Security creates a new incident by correlating multiple related alerts, kicking off your agent's full incident-response playbook.

Fires when a security incident's assigned analyst changes, enabling your agent to brief the incoming analyst and trigger handoff workflows.

Fires when Microsoft Defender correlates a known threat-intelligence indicator against activity on a managed endpoint, confirming an active IOC hit.

Fires when the tenant's Microsoft Secure Score falls below a configured minimum, triggering your agent to investigate which controls regressed and alert the security team.

Fires when a scheduled KQL Advanced Hunting query returns results, letting your agent act immediately on proactively detected threats or anomalies.